Short answer: Use clearnet for a public BTCPay Server checkout when customers, webhooks, wallets, and other integrations need an ordinary HTTPS address. Use Tor-first when the server is at home or in an office behind restrictive NAT, or when keeping the origin IP out of public records matters more than universal reachability. A hybrid reverse-proxy design can keep BTCPay on a private network while exposing only a selected gateway or API through a hardened VPS.
Tor is not an anonymity switch and the available BTCPay documentation does not establish a general Tor-versus-clearnet uptime, latency, or payment-success rate. Treat reliability as a property of your own checkout, webhook, wallet, and Lightning paths, and test those paths from the networks your customers actually use.
As an Amazon Associate I earn from qualifying purchases.
What the two deployment models actually change
“Clearnet” means BTCPay is reachable through the conventional public internet, normally with a DNS name, HTTPS, firewall rules, and a reverse proxy. “Tor” means BTCPay publishes onion addresses for selected services through Tor hidden services. Tor changes how a client reaches those services; it does not automatically move every BTCPay, Bitcoin, Lightning, plugin, or webhook connection into Tor.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11That distinction matters because a payment stack has several separate paths:
#1 Best Overall
- Compact & Portable Design: This Small Excel, Word, PowerPoint, & Windows Cheat Sheet Mouse Pad measures 11.8" x 9.8", offering a portable mouse pad. Its compact size fits in bags or laptop cases, suitable for professionals, students, or travelers.
- Multi-Software Shortcut Guide: Featuring essential shortcut keys for Excel, Word, PowerPoint, & Windows, this small mouse pad provides a quick reference for frequently used shortcuts, offering a reference designed to support workflow efficiency
- Smooth & Precise Surface: The finely-textured surface ensures precise mouse control, allowing for smooth and accurate movement during work or gaming sessions.
- Durable & Non-Slip Design: This Multi-Software Shortcut Mouse Pad features stitched edges to reduce fraying. The non-slip rubber base helps keep it securely in place, and the water-resistant fabric allows for easier maintenance.
- Clear Print Quality: Displays high-resolution printing intended to remain legible through regular use and cleaning
- The shopper’s browser loads the checkout and submits payment information.
- BTCPay talks to its Bitcoin node, Lightning implementation, wallets, plugins, and database.
- External systems deliver webhooks or call an API.
- Lightning peers and other network services maintain their own connectivity.
Each path must be designed and tested independently. An onion checkout can hide the server’s address from a Tor client while a plugin, webhook endpoint, or Lightning connection still uses clearnet.
BTCPay’s Docker architecture documentation states: “It does not route every service connection through Tor and it does not make the deployment anonymous against a targeted attacker.”
Side-by-side decision table
| Deployment | How customers reach it | Origin-IP exposure | What setup requires | Best fit | Primary trade-off |
|---|---|---|---|---|---|
| Clearnet | Conventional DNS name and HTTPS endpoint | The BTCPay address or a public proxy address is visible | Domain, TLS certificate, firewall policy, NAT or port forwarding where applicable, and correctly forwarded reverse-proxy headers | Public stores whose browsers, webhooks, and integrations expect standard HTTPS | More public network exposure and responsibility for DNS, certificates, firewalling, and a stable endpoint |
| Tor-first | Onion addresses for the BTCPay services you publish | Hidden from clients connecting through Tor | Tor-enabled BTCPay deployment, service-by-service exposure decisions, and Tor-capable users or integrations | Home or office hosting, restrictive NAT, or an operator who does not want to publish the host IP | Some customers and services cannot reach onion addresses, and troubleshooting adds an overlay network |
| Hybrid reverse proxy | A normal HTTPS domain at a proxy that forwards selected requests to an onion service | The proxy address is public; the BTCPay host address remains behind Tor | VPS with root access, domain or subdomain, Nginx, socat, and a valid Let’s Encrypt certificate | Selective public exposure of a payment gateway or API while the backend stays on a private LAN | You operate and secure an additional internet-facing server and forwarding layer |
When clearnet is the safer operational choice
Clearnet is usually the least surprising path for a public merchant. A shopper can open an ordinary HTTPS URL without installing or configuring Tor, and many webhook senders, wallet tools, monitoring systems, and API clients are built around DNS and TLS rather than onion addresses.
What a conventional deployment needs
- A name that resolves reliably. Register or delegate a domain or subdomain and point it at the public endpoint you intend to operate. Decide whether that endpoint is the BTCPay host itself or a separate reverse proxy.
- HTTPS and correct proxy handling. Obtain a certificate for the public name and configure the reverse proxy to pass the original host, protocol, and client-request information that BTCPay expects. Incorrect headers can create redirect loops, wrong callback URLs, or broken webhook signatures.
- A deliberate firewall and NAT policy. Expose only the services that customers and integrations need. If the server is on a private network, configure the required port forwarding; do not publish the Bitcoin or Lightning administration interfaces merely because the checkout is public.
- Documented service boundaries. BTCPay’s official Docker deployment is the recommended starting point for self-hosted production. A custom deployment needs careful review of the reverse proxy, PostgreSQL, NBXplorer, Bitcoin node, and chosen Lightning implementation.
- End-to-end tests. Use a real checkout, webhook delivery, wallet notification, and Lightning payment from outside your network before accepting customer traffic.
Where clearnet can fail
- A residential connection may change its public address or sit behind carrier-grade NAT, making inbound connections unreliable or impossible.
- A certificate, DNS record, or proxy-header error can break every checkout even when BTCPay itself is healthy.
- Publishing a direct host address can reveal the location or network of a home or office server and makes that address part of your operational attack surface.
Clearnet is not inherently insecure. It is simply an arrangement in which you must control public DNS, TLS, firewall rules, and the endpoint’s availability.
Rank #2
- [MULTIFUNCTIONAL]You'll get 2 pieces computer monitor memo boards that you can stick on the left and right edges of your monitor, and they're the perfect office desk organizers and accessories. Computer monitor side panels desktop organizer are suitable for home work or office,bringing convenience. Desktop memo is used to organize meeting memos, important messages, business cards, planning notes.Paste on the message board to keep track of important things and to-do items to prevent forgetting.
- [🌟HIGHLY QUALITY] The material of computer screen side note holder is transparent acrylic. Durable, simple, stylish, light weight, easy to use, not easy to fall off or break. This cute office supplies for women desk can be used for a long time. This computer desk accessories is waterproof and dirt resistance, and look simple and stylish. The transparent acrylic sticky note holder as cubicle accessories is easy to notice the context of your sticky notes.
- [📋Easy to use] Office must haves cool office gadgets for desk ready to tear, easy to install and remove, not easy to leave traces. You only need to peel off the protective film on the surface of the computer side board memo, wipe off the dust on the edge of the computer monitor, and then stick the desk essentials for women office on the right or left side of the tape, and you're done. A perfect gift for your colleagues, friends or classmates and family members or relatives
- [🏢MULTI-SCENE USE] This desk supplies computer memo board can be applied to home and office, clear your office decor for women, suitable for most computer monitors, screens and cabinets, you can put it where you think, this cute office decor serve as a reminder. Stick on the computer side. It’s a good office gadgets can remind work improve office productivity. Pasted cabinets, dressers, refrigerators, walls, etc as cubicle accessories. To make life more orderly.
- [💌NOTE] The adhesive force of the computer sticky note holder is very strong. It can not be directly pasted on the computer screen. It should pasted on the black edge of the screen. Narrow edge not recommended!!! If you are not satisfied with your purchase, or if the product is damaged or broken in transit, please let us know immediately. We will promptly solve your problem.
When Tor-first solves a real hosting problem
BTCPay’s deployment FAQ describes Tor mainly as a way to simplify home or office hosting. With onion services, you can avoid opening multiple firewall ports, configuring NAT port redirection, creating a DNS record solely to obtain an HTTPS certificate, and maintaining a fixed public IP for Lightning.
Tor-first setup sequence
- Enable Tor in the BTCPay deployment. Use BTCPay’s supported deployment method and verify that Tor is running before publishing any address.
- Choose services individually. Publish only the BTCPay checkout, API, or other service that users genuinely need. Tor support is selective; do not assume that enabling it transports every adjacent service.
- Record the onion addresses securely. Give customers and integrations the exact address for the service they use. An onion address is not a substitute for authentication, authorization, backups, or plugin review.
- Keep local controls in place. Restrict administrative interfaces to the LAN or a management network, apply host firewalls, and review every listening service after Tor is enabled.
- Test from a Tor-capable client. Load the checkout, complete a small payment, receive the resulting webhook, and verify wallet and Lightning behavior. Repeat after upgrades or configuration changes.
What Tor-first does and does not provide
Tor clients do not learn the BTCPay host IP from the onion connection. That can be valuable when the server is in a private residence or office. It does not make the application anonymous: account names, invoice data, browser characteristics, payment metadata, plugins, logs, webhooks, and external services can still identify an operator or correlate activity.
BTCPay’s deployment FAQ cautions: “But if you’re looking for perfect privacy and security, activating Tor with your BTCPay just won’t do it.” The same guidance notes that other parties may still connect to the instance website, Bitcoin node, or Lightning node in clear.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
The Tor Project also advises operators to configure the web server so it does not disclose information about the operator, computer, or location. That is an application and server-hardening task, not something Tor performs automatically.
Rank #3
- Stay Organized with Ease: Our To Do List Notepad provides multiple sections with plenty of space to jot down all of your important tasks.A versatile office supply perfect for daily task management, helping you keep track of everything that needs to be done and prioritize effectively.
- Achieve Your Productivity Goals: Begin each day on a positive note, reminding you of your potential, strength, and the significance of staying focused on your goals. Our Daily Checklist Notepad is the ultimate tool to streamline your daily planning and elevate your productivity. With a clear and concise overview of your tasks, you can effortlessly prioritize what truly matters and make consistent strides towards achieving your goals.
- Reliable and Stylish: Our to do list planner combines functionality with durability. With a transparent PP cover, the inner pages are well-protected from dirt and wear. Additionally, the back cover is crafted with thick paperboard, offering a stable surface for your writing needs. Each notepad includes 52 pages of high-quality, 100gsm paper, which is thick and non-bleeding, resulting in a smooth and enjoyable writing experience.
- Versatile Use: This daily checklist notepad, suitable for teacher supplies and a wide range of applications, proves invaluable in various settings including work, school, and home. Whether you need to organize your daily tasks, plan a project, or create a grocery list, this notepad serves as the ideal tool. Its compact size ensures easy portability, allowing you to conveniently carry it with you throughout your day.
- Perfect Present for Anyone: Our Daily To-Do List Notepad is the perfect present for those who value organization and productivity. With its stylish design and versatility, this office desk accessory is also a practical addition to school supplies. Suitable for students, professionals, and homemakers alike, it helps keep tasks and priorities in check effortlessly.
How the hybrid reverse-proxy pattern works
A hybrid design puts BTCPay on a private LAN or behind Tor and places a small public proxy in front of only the routes you choose. Customers use a normal HTTPS domain; the proxy sends approved requests over Tor to the BTCPay onion service. The backend host does not need inbound port forwarding.
Required components
- A VPS with root access.
- A domain or subdomain for the public endpoint.
- Nginx as the public reverse proxy.
- socat to bridge the proxy connection to the onion service.
- A valid Let’s Encrypt certificate for the clearnet-facing name.
Implementation sequence
- Prepare the public name. Create the DNS record for the VPS and obtain the certificate before sending production traffic.
- Install and harden the proxy. Restrict administrative access, keep the operating system and Nginx current, and allow only the ports required for HTTPS and management.
- Create the Tor-side path. Configure socat and the documented Nginx reverse-proxy pattern to reach the specific BTCPay onion service. Do not forward unrelated LAN services.
- Preserve request information. Pass the host and protocol headers BTCPay needs, and confirm that generated invoice, callback, and webhook URLs use the intended public domain.
- Limit exposed routes. If only a payment gateway or API is needed publicly, do not expose the administration panel, node RPC, wallet controls, or plugin endpoints.
- Exercise failure recovery. Test what happens when the VPS, Tor path, or home connection is unavailable. Keep a documented way to disable the proxy or switch traffic without opening broad inbound access to the LAN.
BTCPay’s documented advantages for this pattern are “no port forwarding needed on the LAN of the host,” an “encrypted connection,” and that it “hides the IP of the host.” Those benefits depend on correct TLS, Nginx, socat, access-control, and monitoring configuration; a misconfigured proxy can expose more than intended.
Privacy: what is hidden and what remains visible
Network origin
A direct clearnet deployment publishes either the BTCPay server’s address or the address of its public proxy. An onion service hides the backend address from clients using Tor. In a hybrid deployment, observers can see the VPS but not the private BTCPay host through the proxy path.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Application metadata
Tor does not remove identifiers created above the transport layer. A public domain, certificate records, invoice pages, browser behavior, webhook destinations, payment timing, Lightning peer connections, administrator accounts, and logs can all create metadata. Plugins or external services may continue to connect through clearnet even when the checkout is onion-only.
Rank #4
- 【Adjustable & Ergonomic】：This laptop stand can be adjusted to a comfortable height and angle according to your actual needs, letting you fix posture and reduce your neck fatigue, back pain and eye strain. Very comfortable for working in home, office and outdoor.
- 【Sturdy & Protective】 ：Made of sturdy metal, it can support up to 17.6 lbs (8kg) weight on top; With 2 rubber mats on the hook and anti-skid silicone pads on top & bottom, it can secure your laptop in place and maximum protect your device from scratches and sliding. Moreover, smooth edges will never hurt your hands.
- 【Heat Dissipation】 ：The top of the laptop stand is designed with multiple ventilation holes. The open design offers greater ventilation and more airflow to cool your laptop during operation other than it just lays flat on the table.
- 【Portable & Foldable】：The foldable design allows you to easily slip it in your backpack. Ideal for people who travel for business a lot.
- 【Broad Compatibility】：Our desktop book stand is compatible with all laptops from 10-15.6 inches, such as MacBook Air/ Pro, Google Pixelbook, Dell XPS, HP, ASUS, Lenovo ThinkPad, Acer, Chromebook and Microsoft Surface, etc.Be your ideal companion in Home, Office & Outdoor.
Targeted-attacker limits
BTCPay explicitly says Tor activation does not provide perfect privacy or security and does not make a deployment anonymous against a targeted attacker. Protect credentials, isolate administration, minimize logs, update components, and assume that a compromised application can reveal its own data regardless of the route used to reach it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Reliability and usability: what can be concluded
No authoritative controlled benchmark in the cited BTCPay material compares Tor and clearnet for latency, uptime, or payment-success percentage. There is therefore no defensible universal claim that one mode is faster or more reliable by a particular number.
Practical strengths of clearnet
- Ordinary browsers can open the checkout without Tor support.
- Many webhook senders and third-party integrations already know how to reach DNS names over HTTPS.
- Standard monitoring, certificate renewal, and incident tooling is widely understood.
Practical strengths of Tor
- A private server can accept onion connections without inbound port forwarding.
- Tor can be more workable than residential forwarding when the ISP uses carrier-grade NAT or the operator cannot obtain a fixed public address.
- The backend origin is not exposed to Tor clients.
Operational costs of Tor
- The shopper, webhook sender, or integration must support Tor or reach the service through a Tor-capable bridge.
- Onion reachability can be harder to diagnose than a conventional HTTPS failure because the client, Tor circuit, onion service, and application all have to be checked.
- A selective Tor configuration can leave adjacent services on clearnet, creating a false sense that the whole stack is private.
Test the paths that determine your revenue
Run the exact checkout and payment flow from each customer network you care about. Include browser loading, invoice creation, on-chain payment detection, Lightning payment settlement, webhook receipt, wallet notification, and any API call made by your storefront. Record which component failed when a test breaks; “Tor is down” and “BTCPay returned an application error” require different fixes.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Security and maintenance checklist
- Patch the full stack: BTCPay, Bitcoin Core, the Lightning implementation, Tor, the reverse proxy, the operating system, and plugins.
- Review exposure after every change: list listening ports, onion services, proxy routes, webhook endpoints, and administration URLs.
- Protect secrets independently of transport: use strong authentication, restrict administrator access, and do not treat an onion URL as a credential.
- Act on security advisories: BTCPay issued guidance for operators who exposed LND through a reverse proxy, Tor service, forwarded port, or another external route to rotate credentials and update.
- Account for version-specific behavior: BTCPay 2.4.5 added Lightning and LNURL hardening and performance improvements. Its release note says administrators relying on Tor should explicitly enable Tor after updating.
- Monitor both layers in a hybrid design: check the VPS and certificate as well as the Tor service, private host, BTCPay process, node synchronization, and Lightning connectivity.
- Back up recovery material: maintain tested backups of BTCPay configuration, wallet data, node credentials, and the information required to rebuild the proxy or onion service.
A decision framework for merchants
Choose clearnet when all of these are true
- Your customers need a conventional HTTPS checkout.
- Payment processors, webhook senders, wallet tools, and APIs in your stack cannot use Tor.
- You can securely operate DNS, TLS, firewall rules, and a stable public endpoint.
Choose Tor-first when these priorities dominate
- The server is at home or in an office behind restrictive NAT.
- Avoiding publication of the origin IP is a primary requirement.
- Your customers and operational tools can reach onion services.
Choose hybrid when you need both reachability and origin separation
- The BTCPay backend should remain on a private LAN or behind Tor.
- Only a payment gateway or API needs selective clearnet exposure.
- You can maintain a hardened VPS, Nginx, socat, TLS, access controls, updates, and monitoring.
Evaluate the options on four axes: whether every required client and webhook can connect, how much origin-IP privacy you need, how much infrastructure you can maintain, and how quickly you can recover from a failed proxy, Tor path, DNS record, certificate, or home connection. Make the final choice from measured tests of your own flows, not from an assumed Tor or clearnet performance percentage.
Best Value
- Twin-Ball Design : Hiacry gel pen features a double ball conical tip that reduces writing resistance and provides a stable and smooth writing experience. 0.7mm quick drying black ink ensures no jumping, leakage or seepage.
- Quick-Dry Long Lasting Ink：0.7mm black ink can slide effortlessly, dry immediately, & is not easily dirty. It has a high-capacity reservoir (up to 1300 meters), which is very suitable for left-handed & right-handed users.
- Sleek Design for Journaling & Planning: Engineered with a low center of gravity and precision tip for steady ink flow, these journaling pens excel at note-taking, sketching, planning, and more. They combine stylish pens with top-tier performance.
- Rolling Ball Design：The pocket clip with roll ball design can be easily attached to notebook pockets and binders, in addition, the fidget on the pen clip is also a small toy for your daily thinking to relieve stress.
- Comfortable Non-Slip Grip：The ergonomic pen barrel has a soft rubberized coating for a comfortable, non-slip grip, so you won't get fatigued even after long hours of writing.
Migration and incident planning
Move one path at a time rather than changing the checkout, webhooks, and Lightning connectivity simultaneously. Preserve a working administrative route, document the old and new public addresses, and verify invoice creation and settlement before directing all customers to the new endpoint.
If a clearnet endpoint fails, check DNS resolution, certificate validity, firewall and NAT rules, reverse-proxy headers, and BTCPay logs in that order. If an onion endpoint fails, check that Tor is running, the intended onion service is published, the client can reach Tor, and the BTCPay service behind the onion address is healthy. For a hybrid outage, test the VPS and certificate first, then the socat bridge, Tor reachability, and the private backend.
After recovery, review whether the incident exposed an administrative route, stale credential, unexpected plugin connection, or unnecessary public port. Reliability is not just successful payment delivery; it is also the ability to identify and restore the failed layer without broadening access.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
